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n. If ss^iBitr s^a<D7^/ ^-f 7.(D'>s < <!: t, i 
■9— /^-t. 

1f^^fBlir*B5IBffiia©7=/\V X(D'>«:< 1 

BijlB'y-h':7x-rtt. «^^a)fc4&i::x-^jy\>y h^S 
flU MIB^^'J*«iSLTH5IBx-^'/t'>-y Kft^egl 

<<!:«, 1 ^coit^O) 1 ^^Ji^-r-5S«7' KU;^^BulB 
^^'j3b^6gi»aiU MIBt^-- 5i/'C'>-y h<DB(HBffi3iS 
«Z K UX^fiijiB^ =E >J fS' 6SE3^tii L/-cMIBS*lS:-r 

■o 

KbX(cS-:5l^TBuiBT^— 5f/\°'^-;' K7)aifi#«|giiE-r 
S C <*: «4tSii: -r 5 X h U— i^-iSSo 

BUlB^gP;?>-y h-?—' J'tt. VPN (Virtual Private Netwo 
rl<) T^fig* tl^ mB^- h x < tttulBx- -Ji / \°>r y 

BuiB^i•gp*•> b'p-<7{tm^<Dyo bzn\,^mmu m 

y- K-^x-riisuiBT^^— S^M^-y h^fulB^l ©:rn h 
BulBMi cD:/n hn;i/tt, iP:/p|-=];k ATM. Slf7 
mtEf^2(DZfa\':3Mt. \pya\-zi)W ATM. Rt57 
HulB^^- h-^/X'TttSuiBT^— Jf/'fy-y h^^fgLTU? 



HulB'y'-h'i'X'rtiBufBi^aJ^'y h^—^tcjJIft^ 

Us 85137=^—? M'-ir-y h^SulBSffT' FUX^h5IB:><=E 
U *^6ijl*'lXo/i:B!jiB)l<tlS;-rS15«.§«7' FUXT'M* 

SijIBffiSSflT' FU7.<tHufB§fi7' Fl^7.ti5^-7»;l/l;: 

IB+t- msET.^-y'^. *5J:lf1t^^lB1fr^HufB 

Buf3-9— /^-ttx— Si/^^y F^SflLTCtl^^?? 
U HuiBy^ U^^igLTBijlBx^— Fi^eSi?^ 

m Ltci&msmy f u-x^-^iai l. b5ib^ ^ u j: *; boib 

ig^SflT' FU7.tcJ^lS;LTB!jlB7^MV7.<;)!ttS© 1 ^ 

F (DwisEmmsmy f ux^s- mib;>< ^ u esg^^^ai l/c 

B3fB*tlS-rsS«7' FUXlcS^Si^lSCli^ltmt-r 
«X F U— >'ilSo 

[|««JS1 11 W^SI OlB«a)X F U-i?ilS«. * 
etc. y-F':'X'r6>6«lfi£*ti. BijlB'5'"-F'i7X'r 
«. yn-fe-y-y-. ^^'J. a^^gp^oy 1-7— J'lcjggl 
•r«fca&<D'i>ft<it,i-P0)?K-F5«ru gasB^gp^ 
«y F'7-'?timi o:rp F=i;u*15fflU MIBrtSB^-y 
F'7— ?Jim2(Dyp F=i;l/=&ffifflU BuiB'5^- F-^x 
-f ttSuEx-^JA'^-y F^BufB^l <D7^P Fziil/Jb^Siu 

f3^2«)rp Fu;Kcs«-r-5c:d:5i^fr«xFu 
mmr^ 1 21 1 1 tEmo>x f U'-v*'^a^cfcL^ 

T. gyiaSHO^^p F=iiUi. iP:rnF=i;k ATM. S 

mtr^x F u— >"^Bc 

[fi^^i 31 1 iBe<ox F u- v'^s^i:fcL^ 

T. BulBm2<7)yp F=i;W±. IP:/PF=i;k ATM. S 
©i-rST. F U-v^SSc 

[ma?!!! 41 183?^ 1 ^fBe<^xF^-v^ss^cfct^ 
T. lUIB^S^'y F7— ^ttVPN (Virtual Private Net 
work)T«fiB*n. iJIBy-F-Jx-rJitSIBx— Sf/^-ir 



BulE^- •$« / \°y y h (DbuIBS^T' K UX*MIB^< ^ U 6^ 

e.ii!3^ixo/cBufBJ<tj;s-r«ffi«§fi7' kuxt-h*ss^i 
7] oiBttox ^^-i?^ffl^c^5t^ 

T^ MiB-9— /^-f±BulB7=^— S'/ty-y hrttoa— •fy'K 

-'>lcSSit-^/i:4{)CD'>^< 1 OO/I?- h 
S-nSX-f'y^t. 1fii^lB1tLS'!7«SiS<D#UiL- 

U MIB^^ 'J^^PSLTMIBt^— 5»/\°^<y hJb^SSE^A 
aj L/'c1S«§«7' K UX^Itai L. BufBP< ^ U A^etulB 

7=/W7.(D'i>^< 1 ^cDiltSO 1 ^^*iSt-5§« 

Bo 

r 5/c46a)'>^ < 1 1 1 cx^/tf- h BuiB^as^- 
K^—^iilgi <D>^p h=i;i/«-<^fflU fjIBrtSS^-y 
^■7— j7«m2<Dyp ha;U^«fflU MiBy-h-^x 
-TttiulBT^-^'/^'iry h^iulBMl ©^P hsyUA^SSu 

B9fBmi©7^P hP;W4» IPyPhP;k ATM. S 



[»^«2 1 ] iiS^^I 9lBe<DX h U-v-'ilBlcfcCN 
T, S3IBS2(D3''p hP/Ul4. lP:/Phi3;k atm, S 
tf 7 / ^;U£D'>^ < i: t,— C t 

[it3?ja2 2] n^m^ 9umo>x h u-v'^ibic^jin 

T. mS^^^^y (Virtual Private Net 

work) T'^lfiE* lulBy- h -^z x liMfiBT^- -Si / N'-ir 
Hti:ji«tLTVPNftis*ll?T-r«c:^*1t®<t:-r«x K 

T. fijiBX-r-yf^t4BufB7^-^M-'5r>y h^J^PSLTa^ 

-/^glS'J^^lyfB'l? ij a -L.SISiJ?-UB*8S^* ^ 

y'-'S'/i^y h^gttixy. BufB;^^ U^^IPSLTbuIB 

buIBt^-' Siyx^-^'y KDSulBS^iT' KU;^^«ijlBp<^ 
6S!*5tofcMiBJ*/;S-r«ifiSS<17' KU7>TB*«jl 

[11^312 5] if^JSI 8iBe<D7. hb— :>'^BICJSI^ 
Ts MIBX-l'«y^»HijiB7^— S'/\°':r-y hrtOJiL— tfZ K 
UXJC«^UTB5fBx-^'/\°'/y h<^Sfl#*iSliE-r* 

<!:. V—/^-t. BulBtl— M*-. BulBX-f -y^^. i5J:i; 

iu!Bifffi*iBii-r5«ife7=^/wx<o'>^< tt, 1 

Blcfct>T, 

K BulB^ ^ 'J 3b^ S BulB(S3i§^i7' K 

LTB?fBtt«^fBiSTS«»<©x/\*-r < 
tti 1 ^<D^^0> 1 ^^Ji^fSgfiT' HVX^gl^ai 
U 15^7=^— Sf/^-^-y h©BulB{gSS«7'KUX«BulB 



h'?— ?ttll2<Dya h=i;b*fEfflU wifB'y-h^'X 

— v^'^So 

T. BijlBmi<7)7'P h=i;Ut4. IP7^Ph=i;k ATM. » 

[M^]a2 9] ^^^2 ygBttiDX h U-v^SIS(C&*0^ 
T. lulBSI 2 (Dyp t> IP7''Ph3;k ATM. S 

Tx SulBi^aJ^'y hr?— ?tiVPN (Virtual Private Net 
worl<)T'«f!g;^n, Buffi's^- h-^x^tigulBx-^/^'^ 

«y htcj*LTVPNiaia«sii7-rsc:t«itafrs7.h 
[if 51?^ 3 1 ] n^m2 eiBKcDx h ^-v''ss^c*>t^ 

iuiB^ ^ u LT MiBffisy 5 -r h y n - A 

^tix BulB^i-g|5:i^>y h '7—5' fc5^*tl« 7=^—5' /^-ir-y 
h y . BijlBP< =E U L rlulB7=^- / \'y y 

h ft^egS^ai LfcS^T' KU:;?.^*!* U t9f3P< ^ U 

^•y htDHuIBSflT' KU;^5-bu!Bp<^ 'JA^eijSft^ttlL/j: 

m^m^ 3] if ^^2 6iB©(^x h ^-i>'^M^^:fct^ 
Bui3if««'iBifr ««a<^)7^/^'r x(D'>3& < i t i 

IB^SStt, 

B5iB<fi«s«7'KU7.icMf5u iia*eifrs«a® 



[000 11 

i^Tx h u-5?7'^42x«sijffli-r«aii5ttBiji-rso 

[0 0 0 21 

TJ^e«i7*-5^a>i ooo^kll^^:^Jt^T^*^ se«'^* 

nTt^«o iinilTx Sa<DJi*i4J!!«tLfc1f«fifeil!i«(D 

[0 0 0 31 §a<D^«*«;^g*icji^j^trsfc46. 7. 

5o SSP (Storage Service Provider)l4. tfv'^T.lfell 
Tt^-5o SSPtcgfe.5CtlcJ:y. lfellWiSSP-9— t'X 

[0 0 0 41 ssptt7.hu-v'<gs+^— ex^&ii^t-rs 

t^^fSo :3.-+ft4SSP<!:<DF^a5SLA (Service Level 
Agreement) |gl|!f)lcfi£:3T. X h U-v*«ffli:gS-y— 

[00051 

[^^*i«li?-^Lcfe3<fr5iiSl JSlttDSSPajgtcJ: 

*ift*i«^?arso filial*. 3Ktt©iaffl6<i^ssp«ii5icj: 

ni*. SSP«. SSP-y-'T hTSSP)b>m#LTl^Sx-l'X<7 
[0 0 0 61 L*^L3g:««6. SSPa-tfft J:oTJ4. S 

ecoiia^ssp-tt-f h^uiiiiiitetcisat-s^^iitTA^ 

tUnSlV ^J7ll#. a-tf tiSSPf^<7)X h L'-v'v'X 

tc. -b=t^aU7^'rA^ iL— tfstfssP)S:&ictoTSM 

[0 0 0 71 SSPlCt-DTfi. CKD^ti. x-'Si<OIE^ 
1±fl«SIiSlc5*LT«liE?ti. :i—*f1fmmmtjn.-^T 



[0 0 0 8] 

•>TSSP (Storage Service Provider)|*J<0:j5y a— 
[0 0 0 9] *l8fl^©llfifilcj:t»s SSPta— tftt. D. 

— tfajT^-^f-fev^oDaf^s-rssprtrox h u-v^t'/^ 
[0 0 10] :^mm<oi^mtif3^mmTHt. x h u— 

^U. ^gp^^-y h -7- ^7 lessors /c«)<7)'>^<<»:t1 

[0 0 1 1] ^-h't^ji^^tT'-'Sifi^r^y y-^^mLz: 
icmuiSffi^iBti-r«i&j.:<±07^/^'rx<oi#s<D 1 

[0 0 12] Has^lJT'tt. •(fiSSffiT' KL'XtSflT' K 

[0 0 13] sias0ijtcj:oTtt. y-h'^x>r». 7^- 

•7— VPN (Virtual Private Networl<)^gg*Wr 

[0 0 14] mmmiz^-:>Tit. ^as^-y h^-'^a^ 



So mi <7):/p h fc<!:;jltf ip:^p huik at 
ttti5#-e*ti«rii»i<ofl&<D^i'ry®:/p h p;uTt«!to 

[0 0 15] llfiS«IJlt<toTtt. y-h^'X-ri±. 7=^- 

[0 0 16] iifificijic<j:oT«x y-h-^'x^rti, ^gu 

[0 0 17] 2|s:«W(Dfte(DllfifefflJTlix X h b-^^H 
t, 1 H^Jto+J— ■|f^^iB^L§>^;t»« 1 

[0 0 18] T^-^iM-y-y h^SflLC: 

n«IB«U ^^';««ISLTKx— 5»/ty'y hJ:yj|ll 

icmLifffi^lBliTS 1 ^i-x±(OT^/^'rxco!|t^a) 1 

[0 0 19] *^B^(Dflfi£Dliai«IJTti. X h b->>"^S 

3b'«^«5-tiSo *xhu— yp-t-y-y-. 

>^^^0^-b^n■O7.-('y^t. 'tf^^lBtiL§>5?<j« 

-^T'fiifiE^nso 

[0 0 2 0] ^X-ry^l4. X— S'/N^ y H^SfiLC 

a Lfcffisa^T' K ux^«aj l, mmsmy k bx 

{cmLlfffi^iBffi-rS 1 ^iH±(Dy'/UX(D^m<0 1 
A//£«{5-rSS<i7' KbXT'»*«jlS. 



[0 0 2 2] Kma?^iBts-r-5 1 ^i:jl±<dv'/uxu. 
[0 0 2 3] :$imm<oit^m^mmmvit. xku-s? 
[0 0 2 4] *^^icci:y. mmvitiiWj{zm^m'(j<D^ 

-'^SJsl^^aLT, iL-+f<D^x.y h-?-- SSP (S 
torage Service Provider)|^<Odt""J AS^ffifflfSC 

[0 0 2 5] *5l^©IIS6lcJ:y. SSPiZL— <fl4. ZL 
[002 6] 

SSP (Storage Service Provider)!*^ -O-?— ^y 

[0 0 2 71 ^mm<ommic<s:*js ssptu— tft*. a 

—tf<07^-^i-fe>^K0*ft6-rsSP(*g(DX h U-S^x/^ 



al Private Networlc)tt. -O^— *y h<DJ:-5^/\°:?' 

[0028] VPN^fiBffl LTs 2 -pJXi©* \''7-<7 
3bV>-S»-^'y h^aLTS!B!T-*x 1 ^(Dy^'r^- 
«<o«fflWvPN«ti5<o5sa-r'<*isf!i©iott. vpn«« 

[0 0 2 9] FC (Fibre Ciiannel)7.-1'y 

[0 0 3 0] Treic. fifflM^^^'-vaiST'ti. ttiio) 

14*i«»5/1?'J;i-A©@W1S«*ISiliEL&tN„ LUN (Log 
icalUnit Number) -tr+nU 7^ 'r^i^ mX\f. yr^l'^'J- 
^/UT'SlglStlfcX h U- v>x/ Xi»«WWN (Wor I d W 
ide Names) i:ii!PJ*n«SS<D@#1^*«iaiU 7. hlx 

ilSFC7.l'y^tCjgS?|*tl5o *61C. «fflM^#»T- 

[003 1] 01 ti. Hfite^JT^SSP (Stora 

ge Service Provider)<Df^6<)^fl|jEig^^f EIT'^So 

^;i/-:/Ai 0 0 H4. 3.-+f(DP-*;i/^'y h'7— ? 
^^LTt'»«o ^^;u-"^Bi 0 0 ooa- 

C1 006«. ilAa— tf^3^LTt^«„ x-^'Hzy^f 

1 01 3». ns6«»m4v ssptcffl^r^x h u-v^^ 

P/^-<-S«"<O^ST;«fig?n«o x-^i-bV^ 1 0 1 3 

1 -PtDT. h U— 1 0 3 8 *#-rSo 
[0 0 3 2] +f(4WAN (Wide Area Networit) 1 0 1 

2^jlLT. 7^-' S'HZV'S'I 0 1 3 lCjgSg|T'*«c WAN 
1 0 1 2t4. mtf. -r>'$»-^^-y h-^ATM'J-7.l2li!i 

«fflLTx-^'-tr>^r 1 0 1 3H:««!T'*«„ a-+f 
I4x l?ffl<DU-XlHllS^ffifflLT7^— SJ-bV-S' 10 13 

icm.mmmr^ct'hvf^^o f- h-^x^r i o i 4 

T^-^-bV^f 1 0 1 3i^CD^> VD—^ 1 0 1 21C 

mmr^iSioypii< i o<o?k- hoi? s^sr 

[0 0 3 3] h'^X'T 1 0 1 4t4. y'-'Si-il'y^ 1 
0 1 3rt©^y h^—J^ 1 0 2 5ti:jg«IT-5Ja©'>3&< 
t.^ 1 HOI 8*WrSo *y h'?-^' 1 0 



mr^i^(0'pt^ < 1 1 1 -ptD.i^- n 0 4 2 «o 

0 4 4ttXhU-yi 0 3 8lCjt*UT3£e 
fi'J;^tf. SCSI (Small Computer System Interfac 
e)yp h=iil/T'SS^nSLUN (Logical UnitNuniber)i: 

[0 0 3 4] <K-h1 0 4 3«#.'y h-?-^! 0 4 5lt 

3 6(iX hb-v'l 0 3 8. 1 03 7. 1 0 3 4. 1 0 
3 5 lc;?.>y ^-7— ? 1 0 4 5lSSfi7«igl*tl. h U- 
>*«Sm*^«-r«J&»Cffiffl3-tlSo ^ 1 0 2 6tt 

*y ^1 0 2 5(::S!g|-r-5JS(0'>ft<<!:*,lo(0 
0 2 9^Wr*o X-fy^l 0 2 6«XK-U- 
5? 1 0 3 4 ICjglgs-r SJS(0'>^ < 1 1 1 0(0/1?- h 1 0 

3 1 «wr«o fte<Diiss«ij. mxig. ^-y v^-^ i o 

2 St^ y h^--? 1 0 4 5«<ttltlP*-y h^—i^iD^I 

[0 0 3 5] flfiCDSS«g«iJ. mtf. ^ v H*?— ? 1 0 1 
2 6^:^y h-?-' 5' 1 0 2 5<!:SSS^y h'7— 5^. 00^1 
«\ ^ y h'?-'? 1 0 1 2*MP:^y h^-- J7T% h 
■7— J7 1 0 2 5*^FC^y h'7— 5^0!)Jg#», y- h-JX 

-r 1 0 1 4 6^c:<DS^s^oy \'rp-<7rs(J>ya h=i;u^ 
JS<0®S'J«-*fc-ro X h U-v? 1 0 3 4*\ etjx.«. 
•> hrp-'> 1 0 2 sA'fip^^ y b'y-'>T\ brp-'P 
1 0 4 8fi«FC*'y h^-^o^aics^ofcst-ry®* 

[0 0 3 6] iI<D<fe-5^IIJ«i«y<^)«#l±. XhU-v-'l 

P h=i;l/^+J-<K-h-r*o «<J*t#. h'7— ^1 0 4 

8<»::*.> h'7-'?1 0 4 6ab'«S3B:^n::rP 

-hU h'7— ?1 0 4 6fi«:*.«y h'7-'?1 02 5 

<tl5iL::rp hnyu^Sgfflf x-i'-y5^i02 6 

v"' 1 0 3 4 tT. h b->»' 1 0 3 8 Umti-otc^ y h -7- 

xyp h=];U^Sg^-r««tT'*5o 
[0 0 3 7] t,^-o<©llfiS15iJ<!:LTs ^•.•;/h'7— ^1 

0 4 8<!:^y h7— 5^1 0 4 eA'^S^-^fc^y h*?— J' 
:/n h zi;i/*lSffl U X h U-i? i 0 3 4 h 

1 0 3 5*^X<' y5^1 0 2 6^jlLT55«-rSJi^tt. 
T.'T 1 0 2 6A^3^P h =l/U^ift<DigSiJ^Sfcro * 
6iC. :^ h U-v>" 1 0 3 4 iiX h U— 1 0 3 8BS^ 

KU-v»'7''?-tr7.:/'P h=i;U^*Effi-r«»^feSo 7^- 

^•fz^^ 1 0 1 3«:;^-f->^i 0 2 6. *fcttx -9— 

-1 0 2 0. */i:tt55:&6^«flS5-+lTt.ac\ 
[0 0 3 8] H2(4*SII8(0-|gS6«lJT-a)f«aW!6:yP 



«lJT'5^x?tlS:/"P'J^^A«. El <Dy- h-i^X'T 1 0 1 
4<©^^ 'J 1 0 1 5^*\zmm-l£t\.^. 02<7)llfi6CyT'5"x 

*+is*5ic. ii^:rp^^A2 0 O 1 tt. 1 -PJj^±cr> 
VPN (Virtual Private Network) Zfu^f'y L,2 0 0 2^ 
mm.yn'^^U2 0 0 3. tfa-:rpy^/*2 0 0 4. 
:^p|>3;basJft:^p-5^^i*2 0 0 5. at/2l§<i^P'5^ 

^A2 0 0 6*#tJ«»a>g3gypy5A>^P-bXr«l 

[0 0 3 9] VPN :;^P'^^A2 0 0 2«. D.—*fW^y 
'J'y<7^'y h'7-'?«^®ffiLTx-'5i-t>^ 1 0 1 3F»3 

S/c46<DVPN;&«fflL^0^1i^t±. VPN yp^^A2 0 
0 2 ««IISpIg|X*ifeSo IBSErP ^^L. 2 0 0 3 tt. x 
— Sf-t>^ 1 0 1 3F«g<DXhb->>'^/^'l'7.1 0 3 4F«9 

[0 0 4 01 y- h ■^'X-r 1 0 1 46^^— IflgaE^^jto 
^t^^^tt. ^lirP'9^^Zx2 0 0 3tt«BSpJtgT* 
So tfa-:7py5A2 0 0 4li. 7=^— Sz-tr>^ 1 0 1 

[yxomt^^mnr^o yp i-=i/u^«syp-^^iv2 o 

< . o fc h <Kp 5>tD^ y h -7 - <7 TiS^S-nfcilg 

[004 1] ?eic. 3^p hi];u^^:rp<^"^A2 0 0 

5ti. mis:. SCSIi:FC(7)aK. S55:ofcXhU->>'7' 

T'-^'-lrV^i 1 O 1 3^©*'y h'7— ^ 10 12 
ilT^-^-tv^i 1 0 1 3^(D^"y Vn — ^ 1 0 2 5*^1^1 

casosi^tt. 3^p K =j;i/^jftyp A 2 0 0 5 1± 

«f«RrSBT*iBSo 2IS«rpy^Z*2 0 0 6tt^y h-? 

ifa-7^-::/;U2 00 7 
li. tf3.-:/p^^^/;^2 0 0 43b^fijfflT'^5«ic. ^« 
ftiL-+fl;:8ijy^'Teti/cx-4'-b>'-S' i o i 3i^<dx 
hb-v^lCBir«1fffl*«t}tLTfcy. y^'J 1 0 1 5 

[0 0 4 21 03«. *«^©-|IBgClJT'CDfa-7^- 

«6«iJlc^*n5«j<. tfii-7^-:^;U2 0 0 7ttii-if 

0 1 tin— tflCBIt-Stf^^S^v-ro rL-+f7' Ki^X3 0 
0 2«. ilSUlL— tf(D^-»(07'KU7.. «fc«. fiS 
n— 9'(07' KUX-y;i/--y*3^ro a— tf^f/u 
-7^3 0 0 7(DJ:31C. Il-+f^-1'7^300 1 A^'^f/U 
-r'lC-t'V h*nTt>.Sli^«. '?";U-:r3 0 0 7lC 
a-r*a— tf». x-^'-feV'S' 1 0 1 3F*9(D|^— 
-AlCT'^'H'X-rSlljla-^f-b y KDT' KUX3 0 1 



[0 0 4 3] Il-+f'S'-1':?'300 l<)''30 08a)«] 

^»-b>^»1 0 1 3rt<3!><K'Ja— Z^^C7'^^^rXT*#Sa- 
•^fZ KUX3 0 1 1 T'SlfizrtlSo IfiSgmT' KU7.VD 
A (Virtual Destination Address) 3 0 0 3 li^ a— "f 

[0 0 4 4] XI-U-v^T^/^-fXtis a— tPolf^*i«e 

KbXT'*«o Sfi7'KU';^3 0 0 4«. x-^-b>^ 
1 0 1 ^^(I>7.V\y-'J'rl%'<7.(nT KbXT*, 11— tf 

icttra^i-nrt^^t^ mx\s.. sfi7'Kux3 0 04 

or Id Wide Naine}^72&%. 
[0 0 4 5] XhU-S^^IL-'y h*«:^ y h^-' 57^® 

ti:§«7'KUX3 0 0 4*i^S^;*-tii,„ 'SM.y^y-^^— 
Vif-') a.-L.I03 0 0 5«v :i— tf AV^'-feX Lfctvlt' 

U-T-TSSo '1?'Ja-AID3 0 0 6«. IL--tf iCliBi^ 
I*-nTt^^lv1t'';a.-AIDT-fe5o *'>la.-AID3 0 0 

Si-tlSLUN (Logical Unit Nuinber)Tat\ T.VKy— 
v>'IL- > hi*. '1?'Ji-/*ID3 0 0 6*ffll,'>T'1?'Ja- 

[0 0 4 6] ®4tt. *«W©-SI«i«IJT'<7)f«aWftii 

nS<iD<. *ltS6«imix j1«:/P-^^A2 0 0 Hiy 
- Hr^X-f 1 0 1 4F«g<;)^^U 1 0 l 5 (Cly^Sf'So il 

'(i:^a^^A2 00 1 tt. 7=^— ^-t^^ i o i 3rt<o?K 

[0 0 4 71 7^-' Si/x^y h^Sft^. 7.7^ ^^4 0 0 

noo2<7)«i^. T^-- Sf-tiv^KDii-gpjb^esftLfcrt 
vif'i'-^^z-y^ 1 0 1 3tDnaj6^^s«Trnfcig^ 

ti. 5aat±X7^'y^4 0 0 2tcJgfti. ■5-573B:ttntfX 
7^>r4 0 0 8lCJtt,% 7^— Si-tr>^ 1 0 1 3i:(D«S! 
icVPN^SfflfSi^^tt. ;j-:^->a>X7^'y:r4 0 02 
ICT. /'C'^- y h»VPN-rP-J^^A2 0 0 2tcJ:oTjlBa 

[0 0 4 8] ||JgWcJ:oTli. VPN^^^rSii^ 

h'7-^T'7^-^i^5ilfi-r«B5lC7^ 



[0 0 4 91 7t-:^v'3 >X7^'>:?'4 0 0 3tcTx 
igaE:/P'^^/x2 0 0 3lcJ:tly\°'^'y h^SliiESiigft'!^ 
*n«o /N'-ir-y h6^^liE;*-n«ts S&SttXT^ y ^4 0 

-^--y h«*gJ63-nSo 7f-y->3>;^7^y:^4 0 0 4ic 
Tx :/P M3;U^lftyp-J^^A2 0 0 53b\ i6^ts.-^u 

[0 0 5 01 ;^i:ic. X7'y:r4 0 0 5tcT. tfa-yp 

^^Z>.2 0 0 56\ l:ra-7^-:?^^U2 0 0 7<D^^M°y 

•y hcD^^tt. {S^SfiT'KUT.^gffT'KUXlC. {g 
3g/J?'J i-lKiD«^/1t 'J a-Z*ID(cH*lti;^lSc 

[0 0 5 1 1 *IIJS«IJT<Of«a6<I«:triL-:/P'9^5AtO 
teS^IJ^E! 5 iC^fc X7^>vy40 1 SlCTv 
P<f^A2 0 0 S*;)^^^!^**^^!"^-?*^-^^ tTiL- 
yp^^/**i«"no good {mV ^^&\^tcM^\%. 
tiXT^y •:^4 0 0 7 lCT*afe*tl. i^CtD/x'-^'y hftlS© 

i!&ic;^5^<y:f4 0 0 

[0 0 5 21 a5(C. eii-:/"P'9"^A6''"no good (NG)" 
5jS?^*^ofcil^li. 7.7'yy4 0 0 6lCT. I%*T'J 

httT^-^-fev^rto^y hr?— ? 1 0 2 stcaienv 

tea«5!c<3!)/'Cyy KjaiS<3DJ&lCX7^y 7^4 0 0 HCM 
[0 0 5 3] T^-^/^-^y hft'«T^-4'-tV4i 10 13© 

4 00 81CT. l^T'^-'Sf/N^'^'v v\t=r-^-\iy^y 0 

1 3<DF«3g|5«fct)^g|JtCf§«^tlfc^[Rl*/\>'y t-ft^Sft^ 

««*ijs*n«o mwi^^y h3B«7=-^nz>^i 10 13© 

rtSS. «IJ?Hf7. h U-yi 0 3 8. 3b^6§«*nfct© 
X7"'yy4 0 0 9tCT. eii.-^P^^/»2 0 0 
5A«tfa-7^— 7^/1/2 0 0 7rt©^K7=^—S'/\°'!r y h58 

[0 0 5 41 ^(R)*/\-'!r y h©li^tt. gftT' KUX^ 
ffi^SSflT' K U-XIC. /It' U a I D^^^5S<^^ 'J a - A I D 

ffiS^H^T LTat^6\ Sfcli. X7^yr40 14 
^^:Tx^-(HJSiaS*^ToT*^e:^C©M>•y hftvs©^^ 
ItXT^y >''4 0 0 UcM«i)\ **"JS-r5o iMt. sJi® 
^6*r->3>;^7''y^4 0 1 OtCT. T^-^i/f-J-y h 

[0 0 5 51 ;^ClC. VPNeffl^lCli. 7f:r->a>7.7^ y 
•^4 0 1 KCT. VPNyP^5Z:k2 0 0 2)b^x-^i/\°'ir 
•y h«lS«t7-5o VPN7^P-5^5A2 0 0 214, T-^li. 



0 1 mmT'—$'J<<r^y httT^-^-bV^i 1 0 1 

vPN5asx7">y:/4 0 0 2«!:4 0 1 ui'tft^trti-So 

[0 0 5 6] 7=-^-b>^ 1 0 1 3<Di^gP<D:^y ^"7- 
^^1 0 1 ItT^-^-by^l 0 1 3<J5rt8P<o* y h-?- 

1 0 2 st'^mc^-^yoym-^. zfu h^/u^ssiasx 
x>y:^4 0 0 4i:4 0 1 0««BiSprtlT*-5c y-h-J 

•y y 4 0 0 3 ««iiSRrsi7S«o 

[0 0 5 7] ElStt. *M^(D-||«i«IJT<^)f«aW*e 

3.-ya-5^^^,2 0 0 4i:04tDX?*y 7^4 cost 
4009<DfflSlCj*fSr5o USSfiXJT-ttx =r-'^l^'rv 
hSfi^. 7.5^>yy5 0 0 UCTx ^^x— Sf/^^r-y h 
tiT^-rSf-bV^ 1 0 1 3<O^SI5ft^6S(i*tlfcF«9lpJ*7^ 

[0 0 5 81 aS7=-^'/\°':r-v hfe'^T^-^-tV-S' 1 0 1 

h b-v>"7' KU'XT-^S{g«S«7' KbX3 0 0 3tta 
-tftci-p TIE Ll,^6^Sft^*i«!pJS*n«o 

=&a—tf<7)iEH,^7' KUX^SMSLTt^Stfu-T^ 
- :f ;u 2 0 o 7 *#fiar « c i tc J: y IIS65-n«o 

[0 0 5 9] Hffi^im*. {5«§fl7' KbX3 0 0 3 
ti. h^iMflLfciL— ytcStfLTiEL 

3 0 0 3 3!j<iEL<*lttllf. teStt. "no good (NG)'JS 

y5 0 0 2lCT. EI3<Otf;L-ir-:/;U2 0 0 7«<||iS 
LT^ST'-^'/t'J-'y H*3<0<gSS<S7' KUX3 0 0 3 

tc5^tJS;-r *§ft7' K 3 0 0 4 ^5R4{)5c 
[0 0 6 01 i^ClC, ;:^7^'y:/5 0 0 3lCT, ^Sx— 
/N'-^ y hrt<DlgS§il7'KL'X3 0 0 3^e;L-?-7'^ 

;i/2 0 0 7 *^e5i?«>rcSfi7' kux 3 o o 4 ica*«iji 

'mz^ X5^'yy5 0 0 4tcTv ^'Kx-'Sf/'C'^-y h 
^ 615S#- U i -Z* I D 3 0 0 5 ^^Cjft^ti^fJS* n«o 

tf. ^ig7=^-'S'/t'!r«y h^c^^t^T^5«s^l7'K^x3o 

0 3 ^SflT' K 3 0 0 4 IC^Jft Lfc^lSTv 0K««6 

[0 0 6 1 1 ffiS/1?'Ja-/*ID^f^a&tf. Xx>y/5 0 

1 3tCT. ll®tra-7'-:?";U2 0 0 7:&^i-y'>L 
T. i5Si:/^'r^-h/1?'Ja-Z:KlD««7^— Si/N^-^'y 
Jigft urea— tflci* LTiE Lt^6-^3b^3^«^|9JSI*•tl^. ffi 



LL^i^^li, X7'y:^5 0 0 5tCT. ea-7"-y;U2 
0 0 7*«igLT. mmy'-'S'f^'ry \-^mmLtc:L- 
•yicW-rSffiHr^-f^- h'1?'J n-/»ID3 0 0 5*3i 
46«„ ^MCs XT^-yys 0 0 61CT. ^ST'-'S'M'y'y 
hF«gO)ffiS:r^-f^- h'ItU a.-/:. ID 3 0 0 5^tra.- 
7"-:f;U2 0 0 7 3b^63?A6fc<Jt-'J 3.-AID3 0 0 6tCS 

[0 0 6 2] 'r-'$tf«r y hJb^T^-'J'-bV'SH 0 1 3<D 

-ir-yhT'fe^o Lfcfi«oT. 7.5^ y y 5 0 0 7 ICT. tf 
i-x-y;l/2 0 0 7 ^t^LZmm'r—StJi^ y 
Sfla— •ftcm-rSiSSS^T' KUX 3 0 0 3 

■So 

[0 0 6 3] ^ic. XT^yysoosicT, m^T^-^ 

fi<ry hf«3a)S(S7'FUX3 0 0 4^e3.-7^-y;U2 
0 0 7 J: y ttffi Lfca— tffflcD<ES§fiy' KUX 3 0 0 
3icm^tSiA.^o i^UlC. i|aj^<DX7^<yy5 0 0 9tCT, 

Uii-/xlD3 0 0 6^#C-A^««!|9JS*n-5o ^Kt^— 
/\>'y h U-v'T'-^-txn^v K*^*^. ^'Kn 
V > F4i«'1? UIL-AID3006 ^#t,-^ 6. T.y'yZfS 
OlOlCTs tra-7^-yiU2 0 0 7««l5ilLT^^a 
— +fcD/Jt'Jii-AID3 0 0 6^^i6«o ;^7^yy5 0 1 
IICT. <J?';a.-i*ID3 0 0 6$tra-7^-y;U2 0 0 
7 J: t) ttaa LfcIL— tfffl©3*JS;-r SiSS*; ij iL - A I D 3 

0 0 5tC«#»jl5o 

[0 0 6 41 ^^7=^—51 /N'-ir-y h*i«7. hb-v-'T'^-tX 
0K«JII<OlSS*iif tf ai Lfc y P -tr X icilfo -5^- h •? X 

1 0 1 4*i«<}^U3.-z^lD«ate^t^l^^^i. 7.5^'yy 

5004. 5005, 5006. 5009, 5 0 1 0, 
5 0 1 1 , atf 5 0 1 Stt^UgpTilT-JfeSo 

[0 0 6 51 I2l6tt, USSiJiJTroa— ifltm 
•rj:5tc, 7^— Si-bV^ 1 0 1 3itm^^ii^r^tci() 
1 03 4, 1 037, 1 03 8l|OSlS^<DX^• 
■tffi, 1 oJ.X±<0*<y h"?— > 1 0 1 2*ffiffiLT7^- 

0 1 3tc»«irsc4:tcj:y, 5=-^-b>^i 

1 0 1 3rt<^^«&#gii-A±(oifaic7'^'-tx-r 

-So 

[0 0 6 6] m?Hi. y/U-yA 10 0 1 <oa-+f«, 
ffiSSfST' 0 0 1 *ffll>T, WAN1 01 2^ii 

LT, t"— 5^^z>-s^ 1 0 1 sizmmt^. ^fJU-yA 1 

0 0 1 ictt, ifi6<D;^ h- \y-'MtiS.m^'J a-Z*6 0 0 
2<©-<^-vf<tLTa*)tlSo ^JU-ye 1 007Ofte 
<Da— tftt, <KS§fS7'KUX6 0 0 5*fflt''T, WAN 



(0 0 6 7] mmiZ. <flV-ZfB 1 007;c{i. tfiecD 
7. h Ly-'Mi. iS.mt^^J a- A 6 O O ecD-f^-'Jt L 
TStotlSo flAa— 9'a)-?^'f7'>hC 1 006tt. 
i^m^iST K UT. 6 0 0 3 ^fflt^T. WAN 1 0 1 2 ^ii 

LT. 7^-^-ti>-si 1 0 1 Bicmmr^o n-vc i o 

0 6(Cli. h U-v'ttffiJil'li'lJ a-/* 6 0 0 4 

[0 0 6 83 Lfc6'«-3 x—S'-trV'J' 1 0 1 3tt, * 

*e.ic. =S3.-+fi±. X— s»-b>'5i 1 0 1 srtcDfte 

[0 0 6 91 07 *^ia©-||fiS^JT<DftaW*r 

THi. T^p^f^Ati. El 1 1 0 2 orta)p<^ 

V 1 0 2 2rtlCMSI*n5o E7<Dllfifi«'JT'/T^7m«J: 
aft:rP'?'^A2 0 0 1 ti. 1 OJa±<DVPN (Vir 
tual Private Network) ■^P-9'^Z».2 0 0 2. gliE:/'P 
'^■^L.2 0 0 3. tfzL-yp-Jf5A2 0 0 4. :/Ph3 
;l/S8SyP-^^/*2 0 0 5s Ri;5^Sfl:/P-9'^/*2 0 

0 6^#tj^sc<DS«:^p-if^i*7^p-bXT-«fig*n 

So VPN :/'P^^L.2 0 0 2tt. IL-+rj!)Vt:?^'J -y^* 
•y h'7— j7^fi!fflLTT^-^'-b>^ 1 0 1 3F«g<0/1^y 3. 
-AlC7'-5'-feX-r5<^)lc:r5'r'^- h^'-J h-?— 

[0 0 7 0] a— 9*6^ l^y^}"J<7^^v \''7-<7tS:^ 

mmLtsai^mmmT'ii. vpm zfa^^^ixioour^^ 

RTSgT'SSo SliE7^P^^i*2 0 0 3ti. 7^-^-t>5t 
10 13 f^<DX h U-v^T'/t-rX 1 0 3 4 F'gflDlg^tCT' 

-/\'-1 020Ai^lL— ^fig|iE*^Tto:&C^^^^4. ISiiE^ 
P'9^5Z*2 0 0 3t4=tl"SRlllT'fe«o ei-rP-5^^A 
2 00 41*. ^-^-tr>^ 1 0 1 3F«gCDx— Si§affl# 

[007 1] yPhzi;U^«iyp^-5^2 0 0 5«. «lj 

=i;ua}s«itg*wr«o a— tfiistT^-- si-b>^i 0 

■bxrp hzi;U*}#-3iS^tt. -TP h3;Hg«S:/P'9'-7 
^2 0 0 51*. *i«SRlBgT*^5o 
[0 0 7 2] fct^tf. ^7 h-?-- J' 1 0 1 2*i^lP^'y 
h^—^yp h=]/UT% ^-'^ h-?-' J7 1 0 2 56^FC^'> 

fflLTl^Slf^ti. y-h-^X-ri 0 1 4A^S^-pfc^ 

'r:^a):?i«y h'7-'>:rp h=i;up^<D::''p h=i/ui?}ft^?T 
aJ6^6y- h-^^i'f 1 0 1 4«iiSLTS(i#n, y- 



[0 0 7 3] 2S§«rP^^A2 0 0 6tt. ^9- 
0 7f4. t:;L-:^P-75Z^2 0 0 43!)'5?iJffiT$S«lC. 

^mr£3.—*ficm'jmTe>ntc7'-^-ky^ i o i srt 

0 20rt<D/^'J 1 02 2lc:jgra#n«o 07lC5^Lfc 

[0 0 7 4] EI8tt. *«W<0-||fi6<WT'O««W*:r 

P^^Zx<7):?'P'y'i7^f>r7'-9'^AT'^?.<, EI8<Dllfifi«lJ 
Tl4x -^^P^^Ati. m^<D7.■<y=^^ 0 2 6f*i<Dyi=E 
U 1 0 2 8tC®ga5-n«o E8<D||fili«iJT^T*-tlSc!;-5 
tc. ii^yP<^5Z*2 00 1l4. 1-3JX±©VPN (Virtu 
al Private Networl<) yp-9'^/»,2 0 0 2. ISfiEI/P'^" 
^A2003. tra.-:rP^^A.2 0 0 4. yph=i;u 

^Si:?'p^^A2 0 0 5. at;aisfi:rp^^/*2oo 
6 «#t?sa<os^^p •^^A.:rp-b7.T*«lfi£* n«o 
[0 0 7 5] VPN •rP'y^L.2 0 0 2ti. a-+f*iV\°:?^ 
ij •y^'^^y h'7-^'«r«fflLTx-^'-bV-S' 10 131^ 

«fca6<DVPN«•fi|fflU*U^|ISg«iyT'^i. vpn yo<f=yL. 

2 0 0 2««IISqnilTftS„ |giiyP-Jf^A2 0 0 3 

7=— Si-bV^ 1 0 1 3f*}COX h U-i^T^/^C-rx 1 0 

3 4f*3<^ff«tc7'-:7-feXLJ:-5<tLTt^«ZL-+f<Og|iE 

[0076] X-('y^102 6ft^iL— tfgSE^frfcftl^ 
il^l4. igljEyP^^A2 0 0 3««BSDltgT'^§o tf 
7^P^^L.2 0 0 4li. x-^f-t>^ 1 0 1 3|*3«D 

m^r^o yp h =i;u^ift-rp A 2 0 0 5 tt. 

[00 7 7] *6tC. yp h3;l/^jfe7^P^''^A2 0 0 
5«. ■gtjTltf. SCSl<tFCcO«llC. S^c^fcX 

"TSo T^-^-feV^ 1 0 1 3^©:*y h-^-^ 10 12 
1 0 1 3(*9<D^y K-?-' ? 1 0 2 5*\ 
1^ Cmm(DiS^\t. :/P h □;U^»yP^7i* 2 0 0 5 

[0 0 7 8] mmm'cii. 7^— T^-^r-tv^io 

1 3(09^■^t^e>^-h'yJL-f^ 01 4^!SfiLT§ffi* 

-5^- h-^x-r 1 0 1 4^Jgfi&LTi'J-gP-S'-'!r y hiz 

mm^ti^o h-r?-' > 1 0 1 2t^y h'y-<7 1 0 

2 5]tj«S*ofcyp hZi;U*«fflLTt>««^t4. -Jr*- 



mmmTHt. x-r >y ^ i o 2 e t^^my k uxt-^«* 

[0 0 7 9] jil§^i:;^n-y^XK2 0 0 6tt, ^^.yhr?- 
<7^mmLrcmimm^mmr^. tfa-7^-:r;u2o 

0 7ti. ti*iL-3^a>?'^Z^2 0 0 4<)^fiJfflT-*«^lC. 
^i^^a— tfltSJU^TetlfcT^— Si-fe>-Si 1 0 1 31*3 

[0 0 8 0] E19tt. :$im^(D-mmmT<Di^mffiis.y 

VPN (Virtual Private Network) >^P'5''^i».2 0 0 2. 
^II:?^P^^A2 0 0 3. lf;L-3^P-^^A9 0 0 2. 

-So VPN yP-^^L.2 0 0 2«. a— tfi)V\°:?U>y-^4t 
•y h'7-^'€rfi!fflLTx— ^■bV^' 1 0 1 3rtO!)<l?'Ja 

[008 1] zL—*ft\ /izT'j'y'^^'y brp-'>^mm 

ffiffl L^t^Hfife^JT'ti. VPN T'P y^Z:. 2 0 0 2 «aBS 
RitgT'SSo ^iiE:^P^^A2 0 0 3tt. t^— Sf-tr>^ 

1 0 1 3|^©XM^-i?5'/t-rX1 0 3 8P«9CDlf^lC7' 

h U-i>x/t-r7. 1 O 3 8*i«3.-+figlI^?Tfe%L^«|^ 

ttx ig|i7py^i.>2 0 0 3tisaiSRltgT'fe*o 

[0 0 8 2] bri-:rP^f^A9 0 0 2», 7^-^i-b> 
-SJ 1 0 1 31*30)7=— $i§«ffl.1tUa-ACD{53SStfl|y' 
KU7><D^«S^||?7-rS<. T^-- S'IO:^P-Jf^Zx9 00 3 
li, X h U-v'T^^/^-rx 1 0 3 8 lc3^-rSlf^<Dg!*« 
*ll!»f^^S«fr«o 2IS«rP^^L.2 0 0 6tt. 

h 7 - Lfciifi^ltl^lf «-r 5. 

[0 0 8 3] t:D.-y^-Zf)V2 0 0Ht. tfa-^P^ 

^A2 0 0 AmmT^^mic. ^•^^a— *ftcS"jy^ 

TStlfcx— Si-bV^ 1 0 1 3 h u-v^icK-rs 

tf^^^HiJtLTfcy. hb-v»T^/^<7.1 0 3 8rt® 

t g 1 0 4 0 icsBa?n«o e 9 ic/Tx L/cHfigcijT* 
[0 0 8 4] El 1 oli. :$:mm<D-mmmT'(Dnmtif3is. 

llfi§«!lT'». iifiyP'J'^A.g 0 0 1 X h u 
-i^x/^'T:^! 0 3 8rtoytU 1 0 4 0lCgB3*n 



XT^-yyi 0 00 1 ICT, M'^ry hii. ffljx 
tfx •^;i/-:/A<D'j7^-<7'> h 1 o 0 20);^^. x— sj 
•fe > ^ (D^gPA^ 6 Sfl L fcrt iRj* 7^— Si / >y h <)^S6> 

[0 0 8 5] =r-^l<^'J\'1^'r-^^^Z/^^0^3(D 

^gpft^esfiLfcig^tt. 5aaiiX7^«y:f 1 oo i oic 

ii*. •5--5T'*itn(#7.xy7^1 00 1 HCjttr„ x- 
■SJ-bV-Si 1 0 1 3 t(Offi«llCVPN^<gffl-r§J^^tt. ^ 

yz/BZ/7.7■yy^ 001 oicTv /^-iry h»vpN:rp 

-y^/:.2 0 0 2lCj:oTS&S*n5o VPN^^fi^fflfSH 

[0 0 8 6] Lfc««oTx VPN:/'P^^A2 0 0 2«t' 
•y^^l 00 02tCT. ig|iE:^P<?'^/x2 0 0 3lCj:y, 

5Qa«X7^yyi ooo3icjttJo ^3T-^ttn 
t*. X7^-v:n oooTtcT/N^y H«*gSfe*n-5o x 
x'ynooo3icT. t;'jL-yp^^A9 0 0 2*\ 

\f:3.-7—-f)\,7. 0 0 7<D^^7^— $r/\°'!r.y VW^MOi 
ffiS'lfJ a-/*IO^/1t'j a-Z^IDlca*»A.So 

[0 0 8 7] ■immm-Tt<i>^^v^n.\fi3.-yu'f=yu<o 
vmm^^^ uc/T^To 7.7^-y:ri 001 21ct. tfiL 

-7'P^^5A9 0 0 2Ojl&aJeS*i«5^x>y^'*n-5o tf 
i-yp^^A9 0 0 2««"no good (NG)'*jlLyc«^ 
tt. /^'!ry httT.T^ y^/'l 000 7lJ:T*EI63-n, 
=r—9lW 'J hfiaS^JJ^ttXT^yTTl 00 0 1 tCSSo 
ffitc. e'a-:?^P"J^^A9 0 0 23b^"no good (NG)' J&jg 
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Virtual Private Volume Method and System 

BACKGROUND OF TEIB INVENTION 

10 The present invention relates genetally to .data storage systems, and in 

particular to tecfaniques for controlling storage, access based on a designated time. 

The information technology revolution brmgs with it an ever increasing 
need for more storage capacity for business enterprises. It is expected that the average 
Fortune 1000 company *6 storage requirement will more Oian double in the coming years. 

15 In addidon, growth has brought shortages of skilled persons in the infomtation 

teclmology field. These challenges confront many companies fodng flie need to expand 
and improve their information teclmology assets. Increasingly, conq)anies are turning to 
outsourcing storage management as a method of ceding wiA the need to grow capacity in 
view of rapidly increasing demand. Storage Service Providers (SSPs) is one such service 

20 for providing storage in&astcuctuie management to business entezpxises. By subscribing 
to an SSP. companies can obtain needed storage resources by purchasing the services 
from Ihfi SSP. The SSP owns storage systems, which it uses to provide storage capacity 
for the users' host systexos, as well as provide the storage management services. Users 
pay for die storage usage and management services based upon the terms of a service 

25 level agxeement CSLA) made between die user and the SSP. 

While certain advantages to present SSP technologies are perceived, 
opportunities for further improvement exist For example, according to conventional SSP 
technology, the SSP provides storage resources for the host systems in the user's site in 
disk storage systems owned by theSSP at the site. However, some SSP users would like 

30 to locate their equipment remotely &om the SSP site. For example, users may wish to 
access data held in die stomge systems of the SSP via the Internet, or other network. 
Farther, security is an important ooneem to boOi die user and the SSP. For the user, this 
means tiiat valuable business infonnation assets can be p r o te c ted by restricting access to 
the data in storage. For the SSP, this means that data integrity is preserved for its 
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customers, and ftiat no user receives access tiaat is not authorized. For example, various 
divisionfi or depaitments in a large company may wish to have th&t own storage 
resouices, wKch are private and fheiefoze cannot be accessed by members of oAer 
divisions or depaitments. 

What is needed ate improved techniques for ma n aging access to storage 

iBSources. 

SUMMARY OF THB INVENTION 
The present invention provides techniques for managing access to stora^ 
10 resources. In specific embodiments, storage devices provide storage resources to uscn 
using a system of virtual addresses and virtual volume identifiers. In sckct specific 
embodiments, a storage service provider (SSP) can make vohmies available to a \iser, 
which may be a company, for example, in the user's network via tiae Internet or other 
kinds of network connections. In specific embodiments, the SSP and the user's data 
1 5 center can conceal the identity of the storage devices, volumes, and equipment of the 
SSP, as well as that of flie user's data carter in order to provide privacy to both user and 
storage fxovider. 

In a representative specific embodiment according to the present invention, 
a stomge apparatus is provided. ITio storagB apparatus coni^?iiscs a gateway, having a 

20 ptocGSBOU a memoiy, and at least one jp<xi operative to connect to an extemal network; 
one or more devices that store infonnaticiu each of die devices further comprising one or 
more volumes; a server, a switch; and an internal network cormecting the gateway, the 
server, the switch^ and die one or more devices diat store hiformati<Mi. The gateway 
receives a data packet for storing, and thereiqpon searches in Ifae memory finra virtual 

25 destination address retrieved fiom the data packet and thereiqxm reads from the memory 
a correspozuling destination address for a particular one of the one or more devices diat 
store information, and thereupon replaces in the data packet the virtual destination 
address with the corresponding destination address from the memory. In specific 
embodiments, the virtual destination address and the destination addr e s s are stored in a 

30 table. However, in odier embodiments, these addresses, as well as volume identifiers and 
user identifiers may be stored in o&er types of data structures, such as Hnk lists, queues, 
stacks, and so forth. Fur&er, these data structures may be disposed in memoiy or stored 
in a disk storage, and the like. 
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In a specific embodiment, the gateway audienticates a source of the data 
packet based upon a user address in the data packet la some specific embodiments, the 
exteraa] network coiopxises a virtual private netwodc (VFN). In sudi embodiments, the 
gateway, for example, performs VFN processing for the data packet 

5 In specific embodiments, flie external netwoik uses a first protocol and the 

internal network uses a secx>nd protocol* which may be dififerent £rom the first protocol. 
In such cases» the gateway, for example, translates die data packet &om the fltst protocol 
to die second protocol. The first protocol can be any one of an IP protocol, ATM» and 
Fibre chmmel, protocols, for exaznple, as well as aziy of a variety of t)ther protocols 

10 known 1o 4iose skilled in the art Similarly, the second protocol con^srises any one of fte 
previously mentioned protocob. 

In specific embodiments, the gateway searches in the data packet for a 
command and a virtual j^vate volume identifier, and if found* thereupon searches in the 
memory for a volume identifier comsponding to fiie virtual private volume identifier, and 

1 5 diereupon replaces ^e virtual private volume identifier in die data packet with the volume 
identifier. 

In specific embodiments, the gateway receives a data packet being sem to 
the external network, and thereupon searches in the memory for a destination address 
retrieved fit>m the data packet snd thereupon reads firom the memory a corre^nding 
20 virtual destination address from the memory, and thereupon replaces in the data packet 
the destination address witti (he cimnsponding virtual destination address from the 
memory. 

In an alternative specific embodiment according to the present invention, a 
storage apparatus is provided. The storage apparatus con^rises a server, having a 

25 processor, a memory, and at least one port operative to connect to an external network; 
one or more devices that store infbmiation, each of ihe devices further c omp r i s in g one or 
more volumes; a switch; and an internal netwcnrk omnecting the server; the switch, and 
the one or more devices &at store^ifonnation. The server receives a data packet for 
storing, and thereupon searches in the memory for a virtual destioatioa address retrieved 

30 from the data packet, and thereupon reads from the memory a corresponding destination 
address for a particular one of the one or more devices diat store information, and 
thereupon replaces in tbt data packet the virtual destination address with tiie 
corresponding destination address from the memory. 



4 



In an alternative specific embodiment according to fee present invcntioii, a 
storage apparatus is provided The storage apparatus comprises a switch, having a 
pTOcessoT, a memory, end at least one port operative to connect to an external network; 
one or more devices that Btoxe infomiation, each of the devices ftxrtfaer comprising one or 
5 ' more volumes; a server; and anintenial netv/oik connecting the server, die switch, and 
the one or more devices that store infoxmation. The switch receives a data packet for 
storing, and diereupon searches in the memory for a virtual destination address retrieved 
finm the data packet, and tiierevpon reads ftum the memory a corresponding destination 
address for a paiticular one of tiie one or more devices that store information, and 
10 thereupon replaces in data packet ttie vtrtnal destination address with the 
correspondmg destination address finom the memory. 

In an alternative spedfic embodiment according to the present invention, a 
storage apparatus is provided. The storage apparatus comprises one or more devices that 
store information, each of the devices further comprising one or more volumes, a 
1 5 processoTi a memory, and at least cme port operative to connect to aii external network; a 
switch; a server; and an internal netwoik connecting the server, flie switch, and the one or 
more devices 'diat stoxe information. The one or more devices that store information 
receives a data packet for storing, and thereupon searches in the memory for a virtual 
destination address retrieved firom the data packet, and thereupon reads from the memory 
20 a corresponding destination address for a particular one of the one or mote devices that 
store information, and thereupon replaces in the data packet the virtual 
address with the coTxesponding destinadon address £:om the memory. 

In a representative specific emhodiment according to the present invention, 
a metiiod for rxianaging storage is provided. The method comprises receiving a data 
25 packet; searching for a virtual destination address retrieved from tiie data packet; reading 
a corresponding destination address for a particular one of one or tnore devices that store 
information; and replacing in tfap. data packet the virtual destination address with the 
correspondjog destination address. 

Kumeroxis benefits are achieved by way of the present invention over 
30 conventional techniques. Specific embodiments according to the present invention can 
enable a storage service provider (SSP) to make volumes available to a user, which may 
be a company, for example, in die user's netwoik via tiie Internet or other kinds of 
netwodc connections. In specific embodiments, the SSF and the user's data center can 
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conocal &e identity of the storage devices, volumes, and eqo^ancnt of the SSP. as well as 
that of to user's data center in order to provide privacy to both user and storage provider. 

These and other benefits are described throughout the present 
specification. Afortheriinderstaiidingof die nature and advantages of ihein^ 
5 herein may be realized by reference to the remaining poitions of the specification and the 
attached drawings. 

BRIEF DESCRIFnON OF THE DRAWINGS 
Fig.! illastrates a diagiam of a repiesentative configuxa:tion of an example 
storage service provider (SSF) m a specific embodiment of the present invention. 

Fig. 2 illustrates a block diagram of repiesentative programs in a specific 
cmbodunent of the present invention 

Fig. 3 illustrates a diagram of a representative format of a view table in a 
specific embodiment of tiie present invention. 

Fig. 4 illustiates a flow chait of a representative oommiinication pcogram 
in a specific embodiment of tbc present invention. 

Fig. 5 illustrates a flow chart of a representative view program processing 
in a specific embodiment of the present invention. 

Fig. 6 iUostrates a Aagram of a xeprescntativc storage system as seen by a 
nser in a specific embodinient of the present invention. 

Fig. 7 illustrates a block diagram of representative programs in a specific 
embodiment of the present invendon. 

Fig. 8 ilhistratBS a block diagram of representative programs in a q>ecific 
embodiment of the present invention. 

Fig. 9 illustrates a block diagram of representative programs in a specific 
embodiment of the present invention. 

Fig. 10 illustrates a flow ^lart of a Tepresentative commuxxication program 
in a specific embodiment of to present invention. 

30 DESCRIPTION OF THE SPECIFIC EMBODIMENTS 

The present inventioa provides tedmiqnes for managing access to storage 
resonices. In specific embodiments^ storage devices provide stomge resources to users 
using a system of vixtnal addresses and virtual volume identifiers. In select specific 
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embodiments, a storage service provider (SSP) can make volumes availftble to a user, 
which may be a company^ foT example, in die user*8 nctvoik via the Internet or other 
kinds of network connections. In specific embodiments, the SSP and the user*5 data 
center can conceal the identity of the stomge devices, volumes, and equipment of the 
5 SSP, as well as that of the user^s data center in orderto provide privacy to both user and 
storage provider. 

Virtual Private Network (VPN) is a netwoik technology for obtaining 
private netwoik like environments using a public netwod^ such as the Internet Two or 
more networks can connect via the Internet and ccmmunicalB with each other as one 
10 private netwoik using VPN. One noteworthy limitation to conventional VPN 

technologies is that &cy do not conceal the identity of all equipment in the networks that 
comprise the virtual private network. 

Zoning technology is a Fibre Channd (PC) switching technology. Zoning 
tecfam^ogy enables a port to be «getgr^AJ^ to an other port, enabling eqcdpm^ coimected 
15 to one port to be able to use volumes that are coimected to other ports to be assigned to 
that port Conventionally, each piece of equipment connects to the FC switch directly. 
Furdi^, conventional zoning tecbniques do not conceal the identity of volumes which are 
connected to a common port and maybe used by other equipment. 

Logical Unit Number (LUN) security is a storage technology in which a 
20 storage device connected by a Fibre Charmel, for exan^le, detects equipment identities, 
called World Wide Nan»s (WWN), so feat ttw idcmtity of volumes within d» storage 
devices are protected ftom unauthorized access. Conventionallyi eacb piece of equipment 
oomiBcts to the FC switch dxrecfly. Further, in conventkmal approaches* users may be 
aware of a LUN axuipoxt address. 
25 Fig. 1 illustrates a diagram of a representative configuration of an example 

storage service provider (SSP) in a specific embodiment of tiie present invention. Group 
A 1001 indicates a user's local network. Group B 1007 indicates anolto user's local 
network. Client C 1006 indicates a personal user. A data center 1013 conipiises 
eqniimient of a storage provider, which can be an SSP» in a qiecific e mb od im ent The 
30 data center 1013 has at least one gateway 1014 and at least one atorage 103S. Users can 
connect to data center 1013 via a wide aica network (WAN) 1012. WAN 1012 can be for 
example, the Internet, an ATM leased line, and so on. Each user can use the same 
network for connecting to the data center 1013, to example. The users can use their own 
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leased line for conncctiiig to the data center 1013 dhectoiy, as weB, Gateway 1014 has at 
least one poit 1017 foi connectmg to netwoxk 2012 outside of the data center 1013. 
Gateway 1014 has at least one port 1018 for oonnecting to network 1025 inside of iSie 
data center 1013. Netwoik 1025 is used for accessing stosBge devices. Storage 1038 has 
5 at least one port 1042 for connecting to network 1025. Volumes 1044 are defined for the 
storage 1038, and have volume IDs that can be for example a Logical Unit Number 
(LXJN) defined by the Small Conqmter System Interface (SCSI) protocol, for example. 
Port 1043 isccmnected to netwoik 1045, and is used fornumagenient. Management 
tennina] 1036 is connected to storage 1038, 1037, 1034, 1035 vU netwoik 1045. and is 
10 used to define the storage oonfigoration. Switch 1026 has at least one port 1029 for 
connecting to Ae network 1025. Switch 1026 also has at least one port 1031 for 
connectii^ to the storage 1034. Inanodtet specific embodiment, in wMch the netwoik 
1025 and network 1045 are of the same type, for example both are IP networks, network 
1025 and network 1045 can be integrated into one network. In another spedfic 
15 embodiment, in which the netwoik 1012 is of a different type than network 1025, for 
example networic 1012 is an IP network and networic 1025 is a Fibre Channel (FC) 
network, the gateway 1014 provides a protocol exchange function between these different 
types of netwoiks^ In a specific embodiment in which the storage 1034 supports 
networks o f different types, for example network 1 025 is an IP network and a netwodc 
20 1048 is an PC networlc, switch 1026 provides protocol exchange flmctions between &e 
(fiffeient protocols. In such specific embodiments, the storage 1034 and storage 1038 
support different netwo^ protocols. For example, in a Q>ecific embodiment in which 
network 1048 and netwoik 1046 support difEerent protocols, and network 1046 uses die 
same protocol as network 1025, the switch 1026 can provide protocol exchange fuactions. 
25 Further, the storage 1034 and ^ storage 1038 can support different network protocols 
and may use different storage access protocols, as well. In another specific embodiment, 
in which netwoik 1048 and network 1046 use different network protocols and the storage 
1034 and the storage 1035 commui^pato via switoh 1026, the switch 1026 can provide 
protocol exdiange function. Further, the storage 1034 and storage 1038 can support 
30 different netwoik protocols and may use different storage access protocols, as wen. In 
specific embodiments, the data cent^ 1013 can be configured such diat switch 1026, . 
server 1020, or bolh are not incliuled. 
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Fig. 2 illustnites a block diagram of representative programs in a specific 
embodimeixt of the present invention. In a specific embodiment^ the programs illustrated 
by Fig. 2 are disposed in tiie znemoiy 1015 of gatevvay 1014 in Fig. 1. As shown by Fig. 
2, in a specific embodiment, a conununication program 2001 comprises a plurality of 
component program processes, including one or more of a virmai private network (VPN) 
program 2002, an au&entication program 2003 , a view program 2004. a protocol 
exchanger program 2005 and a send and receive i»x}gram 2006. A virtual private network 
(VP>Q program 2002 enables the user to define a private netwcxk for accessing volumes 
wilhin the data center 1013 uang a public netwoiic. Jn a specific embodiment in which a 
user docs not use the virUial private network (VPN) for defining a private network using a 
public network, the VPN program 2002 may be omitted. An authentication program 
2003 inrovides the capability to authenticate the identity of a user \^ attempts to access 
informatbn in one of the storage devices 1034 of the data center 1013* In a specific 
embodiment In whicb the gateway 1014 does not check user identity, the authentication 
program 2003 may be omitted. A view program 2004 jnovides translation of virmal and 
real addresses of volumes for storing data in the data center 1013. A protocol exchanger 
program 2005 provides protocol exchange functions that enable apparatus connected by 
networks of different, topologies comiinsncatB with each other, such as Ibr example an IP 
network coirmumicBting with an FC network. Furfter, the f»otocol exchanger piDgram 
2005 enables a|q>aiatua which use different storage access protocols, such as for example, 
SCSI and FC, to communicate with each ofiier. In a specific embodiment, in which 
network 1012» external to data center 1013, and network 1025, internal to data center 
101 3, are of the same kind, the protocol exchanger program 2005 may be omitted. A 
send and receive program 2<M)6 provides communications fimctions along the netwodc A 
view table 2007, which maintains informatioa about storage in lh» data center 1013 tliat is 
allocated to various users fbr view program 2004, is ^so disposed in memory 101 5. 

Fig. 3 illustrates a diagram of a representative format of a view table in a 
specific embodiment of die present invention. As shown by Fig. 3, in a specific 
embodiment, the view table 2007 con^irises a plurality of information fields for users. A 
user type 3001 indicates information about the user. A user address 3002 indicates an 
address of an individual user's machine, or a group of addresses for multiple users. For 
example, when the user ^e 3001 is set to **groi^," such as for user group 3007, ugcts 
belonging to the group 3007 are defined by a common set of user addresses 3010, which 
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have access to the same vohime in the data center 1013. When the user tyuR 3001 is set 
to '^rsonal/* such as for personal user 3008, then that user is defined by a user address 
3D1 1, which can access a volume in the data center 1013. A Vittnal Destination Address 
(VDA) 3003 is used by the user to specify a stor^ unit knovm to the user. The storage 
5 device has a volume, also known to the user, in which the user's information is stored. In 
a specific embodiment in which a user uses VPN to access data center 1013, tiie virtual 
destination addxess (VDA) is an IP address in a private network defined by the user usi^g 
VPN. A destination address 3004 is an address of a storage device in the data center 
1013, which is not known to ^e user. For example, the destination address 3004 can be 
10 an IP address, a hostname, a Wodd Wide Name (WNN) for a fibre channel network, and 
soforth. When a storage unit has moxe than two ports for connecting to a nctwoxk. then 
the storage unit will have a destination address 3 004 for each port. A virtual private 
volume ID 3005 is used by user's to si>ecify a volume that the user wishes to access. A 
volume ID 3006 is a volume ED that is not known to the user. Volume ID 3006 may be. 
1 5 for exemiple a Logical Unit Ninnber (LUN) defined by the SCSI protocol in various 

specific embodiments. The storage unit accesses iSbt volume using the volume ID 3006. 

Fig^ 4 iUustiates a flow chart of a repxesentative communication progcam 
in a specific embodiment of dlic present, mvention* As shown in Fig, 4, in a specific 
embodiment, communication program 2001 sesides m memory 101 S of gateway 1014. 
20 The communication program 200 1 receives and processes data packets containing data to 
be stored on one of the volumes of the data center 1013. After a data packet is received, a 
check is made whether the data packet is an inbound data packet tiiat was received from a 
soince external to data center 4001 » such as firom client 1002 of Group A, for example. If 
the packet was received teem outside of liie data center 1013, dien processing continues 
25 with step 4002. O&erwise, processing continues wi& step 4008. In an optional step 
4002, ibB packet is processed by the virtual private network program 2002, in specific 
embodiments that use virtual private network to connect with data center 1013. In 
specific embodiments* using a virtual private network involves encrypting data before 
sending it througfh the public network and decrypting it at foe receiving end. An 
30 additional level of security involves encxypting not only the data but also the originating 
and receiving network addresses. Accordingly, in specific embodiments, the virtual 
private netwdk program 2002 peifonns decryption of data, and opticmally address 
information, in the dau packet Next the packet vos^ be authenticated by an 



10 



Autiientication piofflram 2003 in an optional step 4003. If the packet passes 
authcnticatioii, then processing continuefi with a step 4004. Otherwise, tbt packet is 
rejected in a step 4007, In optional step 4004, the protocol exchanger prograxn 2005 
performs any protocol translation required. For example* tiansfbixning data packet 
format, address fiwinata, and so forth. Then, in a step 4005» view prpgram 2005 translates 
address and volume information in tbc data packet according to an entry for the user 
originating the data packet in the view table 2007. For inbound packets, the virtual 
destination addi^ is replaced by a destination address and virtual volume ID is replaced 
widi a volume ID. A representative view program process is illustnted by Fig. 5 for a 
specific embodiment Id a step 401 5, a result of view pno^nm 2005 pcocessing is 
checlwd. If the view program returned "no good (NG)," Ihen tiie packet is rejected in step 
4007| and processing continues with step 400 1 for the next data packet Odicrwisc, if the 
view program did not return **no good," then in a step 4006, fhs pacl^ is sent to network 
1025 ingide the data center, and processing contirmes with step 4001 far the next data 
packet 

If ^ data packet was not received fiom outside of die data center 1013, 
tlien in a step 4008» a check is made to determine if the data packet is outbound 
information rttreived from inside die data center 1013. If the packet was received ftom 
inside dw data center 1013, such as from storage 1038, for exaizqile. then in a step 4009, 
the view program 2005 view program 2005 translates address and volume information in 
die data packet according to an entry for the user originating 1h» data packet in tfie view 
table 2007. For oulbourKlpa<dsts, destination address is replaced by a virtual desdnadon 
address and volume ID is replaced with a virtual volume ID. Otherwise, in a step 4013, a 
decision is made wbefher to terminate processing, or perform an error recovery task in 
step 4014 prior to continuing widi step 4001 for die next data packet Then,inan 
optional step 4010, in a specific embodiment Hie protocol of the data packet is 
exchanged, if needed. Iben. in an optional step 4011, in a specific embodiment that uses 
VPN, the VFN program 2002 processes the data packet. The virtual private network 
program 2002 performs encryption of data, and optionally address information, in the 
data packet Then, in a step 4012, the data packet is sent to r>etwork 1012 outside of data 
center 1013. In a specific ernbodiment in which VPN is not supported or is not used, the 
VPN processing steps 4002 axxi401 1 may be omitted. In a specific embodimoit in which 
the network 1012 outside of the data center 1013 and the network 1025 inside of the data 
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center 1013 arc of the same ^c, the piotocol exchange steps 4004 and 4010 may be 
onutted. In a specific embodiment in which the gatew^ does not check user identity, the 
authentication step 4003 may be omitted. 

Fig. 5 illustrates a flow chart of a representativB view program processing 
5 in a specific embfidinicntofthc present invention. In specific enabodiniBnts, view 

program processing illustrated by Ihe flow chart of Fig. 5 corresponds to view program 
2004 of Fig. 2, and processing of steps 4005 and 4009 of Fig. 4. In a specific 
embodiment, after a data packet is received, a check is made whether the data packet is an 
inbound data packet that was received from a source outside of data center 1013 in a stq) 
10 5001. Ifihedatapacketisfroma8ourceexteEnalto&edatacentBrl013,lfaentna8tBp 
5012, a detenrunation is made wfaecfaer a virtual destination address 3003, which is a user 
defined storage address diat is known to and used by the user» is the correct address for 
flic usex. This may be performed by referring to the view progiram table 2007, which 
piovides the known correct addresses for each user. In a specific embodimentp the virtual 
IS destinatian address 3003 is checked to see if it is the correct address for die user that sent 
the data packet If tlie virtaal destination address 3003 is not c o rr ec t, then processing 
returns a **no good" (NG) return condition to the invoking process. OAcrwise, in a step 
5002, the view table 2007 of Fig. 3 is tearched for a destination address 3004 
concsponding to the virtaal destination address 3003 ernbedded in the data packet Then, 
20 in a step 5003,^ virtual destination address 3003 in liie data packet is replaced by ftset 
destination address 3004 from view table 2007. Then, in a st^ 5004, a deteimination is 
made whetiier tiie data packet includes a storage access command, and if so, whether that 
command includes a virtual volume ID 3005. If the data packet does not include a virtaal 
volusie ID, then processing retozhs to an invoking process with an OK state, haviiig 
25 translated d» vtrtnal destination address 3003 into a destination address 3004 in ^ data 
packet Otherwise, in a step 5013, a determination is made whetier the virtual private 
volume ID for die user who sent tiie data packet is correct, again by checking the contents 
of liie view table 2007. If an incorrect vixtual private volume ID is discovered, dicn 
processing returns a '*no goo<f* return condition to an involdiig process. Otherwise, in a 
30 step 5005. the view table 2007 is searched for the volume ID 3006 corresponding to the 
virtual private volume ED 3005 for the user who sent tiie packet. Then, in a step 5006, the 
virtual voiume ID 3005 in the data packet is replaced witii a volume ID 3006 retrieved 
from die view table 2007. 
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If the data packet was not receivod from outside of the data center 101 3, 
tiien it is an outbound packet Accordingly, in a step 5007. the view table 2007 is 
searched for the virtual destination address 3003 for the user to whom the data packet is 
being sent. Then, in a stqp 5008, the destination address 3004 in the data packet is 
5 replaced wiftx a viztual destination address 3003 for the user letdeved fiom die view table 
2007. Then, in a decisional step 5009, a detenninataon is made whether die data packet 
includes a storage access command and a volume ID 3006. If the data packet includes a 
storage access coounand, azui diat command includes a volume ID 3006. tben the view 
table 2007 is searched for the voliime ID 3006 for &e user in a step 50 10. The volume ID 

10 3006 is replaced with the coircsponding virtual vohmie ID 3005 for the user xetrieved 
from Che view table 2007 in a step 501 1. Otherwise, if die data packet does not include a 
storage access command and volume CD, then the processing letums an **OK" conditicRi 
to an invoking process, having translated the destination address for the user into a virtual 
destination address and the volume ID into a virtual volume ID in the data packet in a 

15 specific embodiment in which gateway 1014 does not handle volume ID> steps 5004, 

5005, 5006, 5009, 5010, SOU, and 5013 maybe omitted. ' 

Fig. 6 iUustiates a diagram of a representative storage system as seen by a 
user in a specific embodiment of the present invraition. As shown by Fig. 6, die data 
center 1013 comprises a plurality of volumes for storing information. In a specific 

20 embodiment, these volumes can be allocated among a plurality of storage units, such as 
storage units 1034, 1037 and 1038, for example. A plurality of users access infozmation 
on various volumes widiin data carter 1013, by connecting to the data center 1013 by one 
or more networks 1012. For example, a user, group A 1001» connects via virtual 
destination address 6001 via die wide area network 1012 to data center 1013. Group A 

25 1 00 1 is presented with an image of dieir storage as a virtual volume 6002. Another user, 
group B 1007, connects via a virtual destmation address 6005 via wide area network 1012 
to the data center 1013. Similaziy, group B 1007 is presented with an image of their 
storage as a virtual volume 6006. Individual user, client C 1006, connects via viztual 
destination address 6003 via die wide area network 1012 to data center 1013. User C 

30 1006 is presented with an image of their storage as a virtual volume 6004. Accordingly, 
the data center 1013 appears like an individual volume to each user. Further, each user is 
blocked fiom seeing storage volumes of another user inside of data center 1013. 
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Fig. 7 illustrates a block diagram of representative pTograTng in a specific 
embodiment oftfaepiesent invention. In an alternative embodiment^ the piogiBms 
Ulufitrated by Fig. 7 are disposed in the memoiy 1022 of server 1024 in I^g. 1. As shown 
Ify Fig. 7« in a specific embodiment^ a eommnnicadon program 2001 con^nises a pluialhy 
5 of component program processes, including one or more of a viitoal private netwodc 
(VPN) program 2002, an authentication program 2003» a view program 2004, a protocol 
exchanger program 2005 and a send and receive program 2006, A virtual private network 
(VPN) program 2002 enables the user to define a private network for accessing volumes 
within the data center 1013 using a public netwotk. In a specific embodiment in which a 

1 0 user does not use the virtual private netwodc (VPN) far defining a private network using a 
public network, the VPN program 2002 may be omitted. An autfientication program 
2003 provides the capability to authenticate the identity of a user who attempts to access 
information in one of the storage devices 1034 of the data center 1013. In a specific 
embodiment in which flie server 1024 does not check user identity, fbc authentication 

15 program 2003 may be omitted. A view program 2004 provides ttanslatton of vuiual and 
real addresses of vohnnes for storing data in fiie data center 1013. A protocol exchanger 
program 2G05 provides protocol exchange functions that enable apparatus which use 
diiferent storage access protocols, such as for example* SCSI and FC. to communicate 
widi each other. In a specific embodiment in which the user's apparatus and the storage 

20 ^aratus of the data center 1 01 3 use same kind of storage access protocol, the protocol 
exchanger program 2O05 may be omitted. In a specific embodiment in which netwodc 
1012 and netwoik 1025 use diflorent network protocols, for example, network 1012 oses 
an IP network protocol and netwoTk 1025 uses Fibre channel, the gateway 101 4 performs 
protocol exchange fimctioas between these difTermt types of network protocols. In a 

25 specific embodiment, data is received fiom sources external to the data center 1013 via 
die gateway 1014, and sent to these external targets via the gateway 1014. A send and 
receive program 2006 provides communications functiona along Ac neCwoxk. A view 
table 2007, which maintains infomiation about storage in the data center 101 3 that is 
allocated to various users for view program 2004, is also disposed in memory 1022 of 

30 server 1024. A specific embodiment, as illustrated by Fig. 7, enables users to have the 
representative user image of the data center storage as illustrated by Fig. 6. 

Fig. 8 illustrates a block diagram of representative programs in a specific 
embodiment of the present inventiorL In an altemative embodiment, die programs . 
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illustrated by Fig. 8 are disposed in the memory 1028 of switch 1026 in Fig. 1 , As shown 
by Fig. 8, in a specific embodiment, a communication program 2001 comprises a plurality 
of component program processes, including one or more of a virtual private network 
(VPN) program 2002» an authentication program 2003, a view program 2004» a protocol 
5 exchanger p io g i au A 2005 and a send and receive imgram 2006. A virtual private network 
(VPN) program 2002 enables the user to define a private network for accessing vohmies 
within the data center 1013 using a public network. In a specific embodiment in which a 
user does not use the virtual private network (VPN) for defming a private network using a 
public netwoik, the VPN program 2002 may be omitted An authentication program 

10 2003 provides the capability to authenticate the identity of a user who attempts to access 
information in one of the storage devices 1034 of the data center 1013. In a specific 
onbodiment in which &e switch 1026 does not check user identity* the authentication 
program 2003 may be omitted. A view program 2004 provides translation of virtual and 
real addresses of volumes for storing data in the data center 1013. A protocol exchanger 

1 5 program 2005 provides protocol exchange functions that oiable apparatus connected by 
networks of dififexent topologies communicate witti each other, such as for example an IP 
networic communicating witii an FC netwodc Further, the protocol exchanger program 
2005 enables ajiparatus which use different storage access protocols, such as for example, 
SCSI and FC, to communicate with each other. In a specific embodiment, in which 

20 network 1012, external to data center 1013. and network 1025, internal to data center 
1013, are of tat same kind, the protocol exchanger program 2005 may be omitted. In a 
specific embodiment, data is received from soiunccs external to the data center 1013 via 
file gateway 1014, and sent to ^se external targets via the gateway 1014. In a specific 
embodiment in which netwcurk 1012 and network 1025 use difibrent network protocols^ 

25 gateway 1014 performs protocol exchange function. Ed this specific embodiment, switch 
1026 sends packets to a poit which is defined by the destination address. A send and 
receive program 2006 provides communications fur^ctions along the network. A view 
table 2007, which maintains information about storage in the data center 1013 that is 
alkacated to various users for view program 2004, is also disposed in memory 1028 of 

30 switch 1 026. A specific embodiment, as illustrated by Fig. 8, enables users to have fiie 
representative user image of the data center storage as illustrated by Fig. 6. 

Fig. 9 illustrates a block diagram of representative programs in a specific 
embodiment of the present invention. In an alternative embodiment, the programs 
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illustrated by Fig. 9 are disposed in the memory 1040 of storage device 1038 in Fig. ! . 
As shown by Fig. 9. in a specific embodiment, a commumcation pxogtam 9001 comprises 
a plniality of component program processes, inclnding one or more of a virtual private 
network (YPN) program 2002, an audientication program 2003, a view program 9002, a 
data 10 program 9003 and a send and receive progcam 2006. A virtual private netwoik 
(VPN) program 2002 enables die user to define a private network for accessing volumes 
within the data center 1013 using a public network. In a specific embodiment in which a 
user does not use flie virtual private network (VPN) for defining a private network usipg a 
pubHc network, the VPN program 2002 may be omitted. An audientication program 
2003 provides the capability to authenticate the identity of a user who attempts to access 
information in one of the storage devices 103S of the data center 1013. In a speeiEc 
embodiment in which the storage device 1038 does not check user identity, the 
authentication progmm 2003 may be omitted. A view program 9002 provides translation 
of virtual and real addresses of volumes for storing data in die data center 1013. A data 
10 program 9003 provides reading and writing of information to and fiom storage device 
1038. A send and receive program 2006 provides communications functions along the 
netwock. A view table 2007, which maintains information aboixt storage in the data 
center 1013 tfmt ia allocated to various users for view program 2004, is also disposed in 
memory 1040 of storage 1038. A specific embodiment, as xDnstnted by Fig. 9, enables 
usera to have the representative user image o f the data center storage as iHustrated hy Fig. 
6. 

Fig. 10 illustrates a flow chart of a representative ccmnmmieation program 
in a speciQc embodiment of tiie present invention. As shown in Fig. 10, in a specific 
embodiment, c om m un ication program 9001 resides in memory 1040 of storage device 
1038. The communication progcam 9001 receives and processes data packets containing 
data to be stored on one of die volumes of die data center 1013. After a data packet is 
received, a check is made whetoer the data packet is an inbound data packet that was 
received from a source external to datacenteir 10001, such as ftom client 1002 of Group 
A, for example. If die packet was leodved fiom outside of the data center 101 3, then 
processing continues wifli step 10002. Otherwise, processing continues wifli step 10008. 
In an optional step 1001 0, fte padcet is processed by the virtual private network program 
2002, in specific embodiments that use virtual private network to connect with data center 
1013. In specific embodiments, using a virtual private netwoik involves enaypting data 
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before seiK&ig it through tfie public network and deciyptisg it at the lecsiving end. An 
additional level of security involves enciyptuig not only the data but also tiiie originating 
and receiving netwodc addresses. Accordingly, in specific embodiments, the virtual 
private networic program 2002 peifonns dectyptioa of data, and optionally address 
infbrxnatiao, in &e data packet Next, ^ packet may be authenticated by an 
authentication piogram 2003 in an optional step 10002. If the packet passes 
authentication, then processing continues with a step 1 0003 . Otboivise, &e packet is 
rejected in a step 10007. In a step 1003, view program 9O02 translates address and 
volume infomiation in the data packet according to an entry for the user OTiginating the 
data packet in the view table 2007. For inbound packets, the virtual volume ID is 
zeplaced with a volume ID. A representative view program process is illustrated by Fig. 
11 for a specific embodiment In a step 1001 1, a result of view i^ogram 9002 processing 
is checked. If the view program 9002 returned "no good (NG)," then the packet is 
rejected in step 10007» and processing continues with step 1 000 1 for the next data packet 
Oti)erwise, if the view program 9002 did not return "no good,** then in a step 10004, data 
lO processing is performed. Data lO program 9003 reads information from a data packet 
to a volume or writes infiwrnation from a data packet to a volume according to a storage 
access command. After data 10 processing, processing contimies with step 1000 1 for the 
next data packet 

If in step 10001, it is detennined that the data packet was not received 
ftom outside of the data center 1013, then in a decisional step 1001 1, a determination ia 
made whetiier tiie data packet is from Ae data lO program 9003 sending a command or 
data. If the data packet was sent by the data lO piogram 9003, then, in a step 100D5, a 
view program 9002 translates address and volume intomation in the ^ fltn packet 

according to an eatxy for the user originatmg^ data packet in die view table 2007. For 
outbound packets, the volume ID is replaced with a virtual vohmie ID. Theri, in a step 
10006. die data packet is sent outside of the data center, and processing continues with 
step 1 000 1 for the next data packet Otherwise, if tfie data packet was not sent by the data 
lO program 9003, ttien in a step 1000«, a check is made to determine whether to 
terminate procesang. If the decision is made to terminate processing, then Ac processing 
is temnnatsd. Otiierwise, an error recovery process is p^ibrmed in a step 10009, and 
then processing continues with another data packet in step 10001 . In a specific 
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erobodimeiii in which the stor&ge 1038 does not check user identity, euthoitication step 
10002 maybe omitted. 

Fig. 1 1 illustrates a flow chart of a representative view program procesang 
in a specific embodiment of the present invention. In specific embodiments, view 
5 program processing illustrated by the fiow chart of Fig. 1 1 corresponds to view program 
9002 of Fig. 9, and processing of steps 10003 and 10005 of Fig. 10. bi a specific 
embodiment, after a data packet is zeceived> a check Is made whether &e data packet is an 
outbotmd data packet diatbemg sent fiomUic data center 1013 in a step llOOl. If the 
data packet is from a source external to the data center 1013, then Otherwise, processing 

10 continues with a step 1 1 005. Then, in a step 1 1002> a determination is made whether the 
data packet includes a storage access command, and if so, wiiettieT that command 
includes a virtual volume ID 3005. If the data packet does not include a virtual volume 
ID, then processing returns to an invoking process with an OK state. Otherwise, in a step 
1 1009. a determination is made whether the virtual (vivate volume ID for the user who 

1 5 sent the packet is correct, again by checking tbe contents of the view table 2007. If an 
xncoirect virtual private volume ID is discovered, iiicn processing returns a '"no good" 
return condition to an invoking process. O^erwise, in a step 1 1003, ttte view table 2007 
is searched for the volume ID 3006 coireqx>ndiQg to the virtual private volume ID 3005 
for the user wbo sent the packet Thec^ in a step 11004, the virtual volume ID 3005 in the 

20 data packet is rqpilaced with a volume ID 3006 retrieved ^m the view table 2007. 

If &e data packet was not received from outside of the data center 1013, 
then it is an ou^und packet. Accordin^y, m a decisional step 1 1005, a determination is 
made whether the data packet includes a storage access command and a volume ID 3006. 
If die data packet includes a storage access coimii)aiid« and that command includes a 

25 volume ID 3006, dien the view table 2007 is searched for the volume ID 3006 for the user 
in a step 1 1006. The volume ID 3006 is replaced with the corresponding virtual volume 
ID 3005 for the user retrieved from the view table 2007 in a step 1 1007. Otherwise, if the 
data packet does not include a stosrage access command and volume ID, then tbe 
processing returns an "OK" condition to an invoking process, having translated the 

30 destination address for the user into a virtual destirution address and tiie volume ID into a 
virtual volume ID in tbe data packetl. ''A specific embodiment, as illustrated by Fig. 1 1, 
enables users to have die representative user image of die data center stora^ as illustrated 
by Fig. 6. 
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In aoooiding to other embodisacnt of liie invention, these equipment in 
data center, like a gateway, server, switch, and storage, any equipment has these view 
change fimction at same time. 



The preceding has been a descrqstion of the prefeixed embodunent of the 
inventioo. It will be appreciated ftaX deviations and modifications can be made without 
defpaiting fiom tfac scope of the invention, which is defined by the appended claims. 
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^V^tk claimed is: 

1 1 « A. storage apparatus comprising: 

2 a gateway, having a processor, a mcmoxy. and at least one port operati^x to 

3 connect to an external network; 

4 at least one of a plurality of devices that store information, each of said 

5 devices further comprising at least one of a pluralit/ of volumes; 

6 aserver; 

7 a switch; and 

8 an internal network ccmnecting said gateway* said server, said switch, and 

9 said at least one of a plurality of devices that store infoznmtion; wherein 

1 0 said gateway receives a data packet for stonng, and thereupon searches in 

1 1 said memoxy for a virtual destination address retrieved ham said data paclcet, and 

1 2 theretqxm reads from said memory a oonesponding destination address for a particular 

13 one of said at least one of a phimlity of devices that store information, and thereupon 

14 replaces in said data packet said virtual destinaticm address with said conesponding 

1 5 destination address fma said memoiy. 

1 2. The apparatus of claim 1» wherein said gateway authenticates a 

2 source of said data packet based upon a user address in said data packet 

1 ' 3. The apparatus of claim l,wfae]»in said external network ccmiprises 

2 a virtual private network (VPN), and wherein said gateway perfonns VPN processing for 

3 said data packet. 

1 4. The apparatus of claim 1, wherein said exteinal network tises a first 

2 protocol and said internal network uses a second protocol, and wherein said gateway 

3 translates said data packet fiom said first protocol to said second protocol. 

1 5. The apparatus of claim 4, wherein said first protocol comprises at 

2 least one of IP protocoU ATM, and Fibre channel. 



1 6. The apparatus of claim 4, wherein said second protocol comprises 

2 at least one of IF protocol, ATM, and Fibre channel 
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1 7. Tae appaxatus of claim 1, wherein said gateway searches in said 

2 data packet for a ccMXunand and a virtual private volunie idcntiiier, and if found, 

3 thereupon searches in said memoiy for a volume identifier corresponding to said virtual 

4 private volume identifier^ and thereupon replaces said virtual private volume identifier in 

5 said data packet with said volume identifier. 

1 8. The apparatus of claim 1» wherein said gateway receives a data 

2 packet being sent to said external network, and theieuiwn searches in said memory for a 

3 destination address retrieved from said data packet, and thereupon reads from said 

4 memory a conesponding virtual destination addi^ from said memoiy, and diereupon 

5 T^laces in said data packet said destimtian address with said corresponding vutnal 

6 destmation address from said memory. 

1 9. The apparatus of claim 1 , wherein said virtual destination address 

2 and said destination address axe stored in a table. 

1 10. A stomge apparatus c ouipiibin g: 

2 a server, having a processor,^ a memory, and at least one port operative to 

3 coxmect to an extecoal network; 

4 at least one of a plurality of devices that store information, each of said 

5 devices fhrtber comprising at least one of a plurality of volumes; 

6 a switch; and 

7 an internal networic coimecting said server, said switch, and said at least 

8 one of a plurality of devices that store infonmation; wherein 

9 said server receives a data packet for storing, and thereupon searches in 

10 said memory for a virtual destination address retrieved from said data packet, and 

1 1 thereupon reads from said memory a corresponding destination address for a particular 

12 one of smd at least one of a plurality of devices that store information, and thereupon 

1 3 replaces in said data packet said virtual destination address with said corresponding 

14 destination address from said memory. 

1 11. The appamtus of claim 1 0, further comprising a gateway, said 

2 gateway having a processor, a memory, and at least one port opcmtive to connect to an 

3 external network, and wherein said external network uses a first protocol and said internal 
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4 network uses a second protocol, and wherein said gateway translates said data packet 

5 from said fust protocol to said second protocol. 

1 12, The apparatus of claim 1 1 , wherein said first protocol comprises at 

2 least one of IP protocol, ATM» and Fibre channel 

1 13. Hie apparatus of claim 1 1 * wherein said second protocol comprises 

2 at least one of IP protocol, AIM, and Fibre channel. 

1 14. The apparatus of claim 1 1 , wherein said external network 

2 comprises a virtual private network (VPhQ, and wherein said gateway performs VPN 

3 processing for said data packet 

1 15. The apparatus of claim 1 0, wherein said server searches in said 

2 data packet for a command arKi a virtual private volume identifier, and if found, 

3 thereupon searches in said memory for a volume identifier corresponding to said virtual 

4 private volume identifier, and thereupon replaces said virtual private volume identifier in 

5 said data packet with said volume klentifier. 

1 16. The apparatus ofclaimlO« wherein said server receives a data 

2 packet being sent to said external network, and thereupon searches in said memory for a 

3 destination address retrieved from said data packet, and thereupon reads &om said 

4 memory a corresponding virtual destination address fifom said memory* and thereupon 

5 n^laces in said data packet said destination address with said corresponding virtual 

6 destination address from said memory. 

1 17. The apparatus of claim 10, wherein said server authenticates a 

2 source of said data packet based upon a user address in said data packet 

1 1 8. A storage apparatus comprising: 

2 a switch, having a processor, a memory, and at least orse port operative to 

3 connect to an external network; 

4 at least one of a plurality of devices that store information, each of said 

5 devices fhrther comprising at least one of a plurality of volumes; 

6 a server, and 



22 



7 an internal network connecting said server, said switch, and said at least 

8 one of a plurality of devices that stoic infomalion; wherein 

9 said switch receives a data packet for storing, and thereupon searches in 

10 ssid memory for a virt^^al Hefttination address retrieved from said data packet, axKl 

1 1 thereupon reads from said memory a corresponding destination address for a paiticulax 

12 one of said at least one of a plurality of devices fhat store infoimation. and thereupon 

1 3 replaces in said data packet said virtual destination address with said corresponding 

14 destination address firom said memory. 

1 19. The apparatus of claim 18, further comprising a gateway, said 

2 gateway having a processor, a memory , and at least cxie port operative to connect to an 

3 extensal network, and wherein said external network uses a £rst protocol and said internal 

4 network uses a second protocol, and wherein said gateway tcanslates said data packet 

5 from said first protocol to said second protocol 

1 20. The apparatus of claim 1 9, wherein said first protocol comprises a1 

2 least one of IP protocol, ATM, and Fibre channel. 

1 21. The a]^)aratus of claim 1 9, wherein said second protocol comprises 

2 at least one of IP protocol ATM, and Fibre channeL 

1 22. The apparatus of claim 19, wherein said externa] network 

2 comprises a virtual private network (VPN), and wherein said gateway performs VFN 

3 processing for said data packet 

1 23. The apparatus of claim 1 8, i^^imin said switch searches in said 

2 data packet for a commarxl and a virtual private volume identifier, and if found, 

3 tiiereupon searches in said memory for a volume identifier corresponding to said virtual 

4 private volume identifier, and thereupon replaces said virtual private volume identifier in 

5 said data packet witb said volume identifier. 

1 24. The apparatus of claim 1 B, whmin said switch receives a data 

2 packet being sent to said external network, and theroupon searches in said memory for a 

3 destination address letrieved fiom said data pack^, and thereupon reads &om said 

4 memory a corresponding virtual destination address fiom said memory^ and thereupon 
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5 replaces in said data packet said dcstinouGn sddxcss Vriui ssid cG7ieavK>iidii^6 viitual 

6 destinatioii address from said memory. 

1 25. The apparatus of claim 18, wherein said switch authenticates a 

2 source of said data packet based upon a user address in said data packet. 

1 26. A storage apparatus con^prising: 

2 at least one of a plurality of devices that store information, each of said 

3 devices further comprising at least one of a plurality of volumes, a processor, a memoiy, 

4 and at least one port operative to connect to an external netwotl^ 

5 a switch; 

6 aservex;and 

7 an internal network oonnecting said server, said switch, and said at least 

8 one of a pluiality of devices that store information; indiercin 

9 said at least one of a plurality of devices that store information receives a 

1 0 data packet for storing, and thereupon searches in said memory for a virtual destination 

1 1 address retrieved fiom said data packet, and thereupon reads from said memory a 

1 2 corresponding destination address far a particular one of said at least one of a pluiali^ of 

1 3 devices ttmt store infonnation, and theieupon replaces in said data packet said virtual 

14 destination address with said corresponding destination address from said memoiy. 

1 27. The apparatus of claim 26, furHier comprising a gateway, said 

2 gateway having a processor, a memory, and at least one port operative to connect to an 

3 eT&temal network, and wherein said external network uses a fixst protc}Col and said internal 

4 network uses a second protocol, and wherein said gateway tcanslates said data packet 

5 from said iirst protocol to said second protocol. 

1 28. The apparatus of claim 27, wherein said first protocol comprises at 

2 least one of IP protocol, ATM, and Fibre channel. 

1 29. The appamtttsofclaim 27, wherein said second protocol comprises 

2 at least one of IP protocol, ATM, and Fibre channel. 

1 30. The apparatus of claim 27, whersin said external network 

2 comprises a virtual private network (VPN)» and >x^erein said gateway perfomis VPN 

3 processing for said data packet 
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1 31. The apparatus of claim 26, whereia said at least one of a pliiiality 

2 of devices that store infonnation aearclies in said data packet for a command and a virtual 

3 private volume identifier, and if found» theieupoQ searches in said memoi> for a volume 

4 identifier corcesponding to said virtual private volume identifier, and thereupon replaces 

5 said vixtoal private volume idendfiei in said data packet with said volume identifier. 

1 32. The appaiatus of claim 26, wherein said at least one of a plurality 

2 of devices that store infonnation receives a data packet being sent to said external 

3 networic, and thereupon searches in said memory for a destination address retrieved fiom 

4 said data packed and thereupon reads from said niemory a corresponding virtual 

5 destination address fiom said memory, and diereupon replaces in said data packet said 

6 destination address vnth said corresponding virtual destination address from said 

7 memory. 

1 33. The apparatus of claim 26, wherein said at least one of a plurality 

2 of devices that store infonnaticm authenticates a source of said data packet hased upon a 

3 user address in said data packet. 

1 34. A method for managing storage, comprising: 

2 receiving a data packet; 

3 searching for a virtual destination address retrieved from said data packet; 

4 reading a corresponding destination address for a paiticalai one of at least 

5 one of a plurality of devices dut store lllfof^natior^ and 

6 replaciog in said data packet ssdd virtual destination address with said 

7 corresponding destinatian address. 
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Virtual Private Volume Method and System 

ABSTRACT OF THE DISCLOSURE 
5 The pcesent invention provides techniqaes fox managing access to stona^ 

resouzces. In specific embodisients, storage devices provide storage resouEces to users 
using & system of virtual addresses and virtual vohune identi6ers. In select specific 
embodiments, a storage service provider (SSP) can make volumes available to a user, 
wfaich may be a company, for example, in the user's oetwork via the Internet or other 
10 kinds of network connections. In specific embodiments, the SSP and the user's data 
center can conceal the identity of the storage devices, volumes, and equipment of die 
SSP, as well as that of the user*s data center in order to provide privacy to bofii user and 
storage provider. 
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